eBPF process plugin (#7979)

* syscall_plugin: Compilation

This commit brings the necessaries changes to the compilation files

* syscall_plugin: Collector body

This commit brings the collector body to files.

* syscall_plugin: .gitignore

This commit adds syscall.plugin to .gitignore

* syscall_plugin: Plugin adjust

Fix reference and remove message

* syscall_plugin: Remove limit

Remove call to setrlimit

* syscall: Fix start

This commit fixes problems related with start of the plugin

* syscall_plugin: Bring heartbeat

This commit removes the sleep and changes to heartbeat to avoid plugin receive a SIGTERM

* syscall_plugin: Missing semicolon

* syscall_plugin: Fix dimension

Brings the initial value of chart for the normal dimension of the other values

* syscall_plugin: Fix dimension 2

The previous change did not give the expected results, so I am bringing more a fix

* syscall_plugin: adjust values

Rename function and adjust pid size

* syscall_plugin: Remove Chart and fix var

this commit removes a chart that will not be created and fix an error
when the bytes were calculated

* syscall_plugin: Brings error

This commit brings a new variable that will be used to identify errors

* syscall_plugin: Rename charts

This commit starts to rename the charts properly

* syscall_plugin: Rename plugin

* syscall_plugin: missing changes for rename

* syscall_plugin: fix compilation

* syscall_plugin: bring new charts

* syscall_plugin: Warnings

Remove warnings from compilation time

* vfs_plugin: Fix Error chart plot

There was an error when the chart was being displayed

* vfs_plugin: Change family

This commit changes the family of the VFS plugin

* vfs_plugin: Fix order

This PR fixes the wrong order when creating a chart

* vfs_plugin: Remove path

Remove path from structure

* vfs_plugin: From Perf to HASH

This commit converts the main source a hash table and also split the data collection per chart

* vfs_plugin: Adjusts and exit

This commit brings adjusts to the collect and the complete monitor to exit events

* vfs_plugin: Start process

This commit brings the monitoring of a process start and thread creation to Netdata

* vfs_plugin: Visualization and collection

Adjust variables to show and to collect data

* vfs_plugin: Connection with apps plugin

This commit starts to bring the connection with apps.

* vfs_plugin: Various

This commit brings new label for charts, fix to error chart and adjusts for new charts, I am sorry

* vfs_plugin: basis new chart

This commit brings the basis of the new charts for the plugin

* vfs_plugin: Apps plugin

This commit brings the integration with apps.plugin

* vfs_plugin:fix counter

This commit fixer the difference between apps plugin and counter

* ebpf_plugin: rename charts

This commit renames the charts

* ebpf_plugin: New charts adjusts and log start

* ebpf_plugin: Log thread

Creates the log thread that will be used to store error message

* ebpf_plugin: Rename Web Group

This commit reorganize the charts on dashboard

* ebpf_plugin: Restore

This commit restore the previous status of the collector where we only have a global vision of the problems

* ebpf_plugin: kretprobe

This commit brings the initial changes for the collector works with both eBPF program

* ebpf_plugin: New syscalls

This commit brings the new syscalls that we are monitoring

* ebpf_plugin: New charts

This commit brings new charts to the collector

* ebpf_plugin: Parse config

This commit starts the parser of the file

* ebpf_plugin: collector debug

* ebpf_plugin: Global variables from config

This commit brings the global variable update from the config file

* ebpf_plugin: Clean kprobe_events

This commit brings the clean of kprobe_events and also starts the common library for all eBPF collectors

* ebpf_plugin: Check kernel version

This function brings a check for the kernel version

* ebpf_plugin: Start documentation

This commit brings the initial documentation for the users

* ebpf_plugin: Documentation

This commit brings adjust to code and updates for the documentation

* ebpf_plugin: this commit brings the developer mode to the collector

* ebpf_plugin: Documentation

This commit brings more information to the documentation

* ebpf_plugin: Documentation

This commit brings more information to the documentation

* ebpf_plugin: errno to logs

Brings errno number to logs

* ebpf_plugin: Documentation

This commit brings fixes to the collector documentation

* ebpf_plugin: Move description

This commit move the chart description from the C code to dashboard_info.js

* ebpf_plugin: Rename files

This commit rename files to the final version

* ebpf_plugin: COntinue renaming

This commit continue renaming the files to the final version

* ebpf_plugin: Renaming process

This commit renames the final plugin

* ebpf_plugin: Finish rename

This commit finishes the rename processing

* ebpf_plugin: fix entry charts

This commit removes one chart from  mode

* ebpf_plugin: Fix remove

This commit brings a new function to fix the unload of collector when the collector
is running in entry mode

* ebpf_plugin: Rename on old kernels

This commit brings fixes for syscall names

* ebpf_plugin: Timestamp to log

This commit brings the timestamp to the logs

* ebpf_plugin: Remove syscall

With the changes on the backend, we are not monitoring more sys_clone

* ebpf_plugin: The syscall is important for 5.3 or newer, so I am returning

* ebpf_plugin: Remove concurrency

This commit adds variables necessary to interact with the new structor
of the eBPF program

* ebpf_plugin: Ids to dimension

This commit fews the functions name as ids for the dimensions

* ebpf_plugin: Missing chart

This commit brings the missing chart for Netdata

* ebpf_plugin: Remove unecessary message

Remove unecessary error message from the collector

* ebpf_plugin: Rename dimension

This commit renames the dimension for something more meaninful

* ebpf_plugin: Optional log

This commit converts the developer.log in an optional feature

* redirect to stdoou

This commit starts to bring the capability to redirect everything to stdout

* ebpf_plugin: Disable dev mode

This commit removes the possibility to load the dev mode file for while

* ebpf_plugin: Disable eBPF process

By default this plugin won't be enabled

* ebpf_plugin: Update debug message

* ebpf_plugin: this commit adjusts documentation to next release.

* ebpf_plugin: documentation fix.

* ebpf_plugin: Percpu hash

This commit moves from an unique hash table for various to speed up
the collector

* ebpf_plugin: Compatibility

This commit set compatibility version between kernels

6 files changed, 124 insertions, 0 deletions

diff --git a/libnetdata/Makefile.am b/libnetdata/Makefile.am
index d239d4b019..598b72f5b0 100644
--- a/libnetdata/Makefile.am
+++ b/libnetdata/Makefile.am
@@ -10,6 +10,7 @@ SUBDIRS = \
     clocks \
     config \
     dictionary \
+    ebpf \
     eval \
     json \
     health \
diff --git a/libnetdata/ebpf/Makefile.am b/libnetdata/ebpf/Makefile.am
new file mode 100644
index 0000000000..161784b8f6
--- /dev/null
+++ b/libnetdata/ebpf/Makefile.am
@@ -0,0 +1,8 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+AUTOMAKE_OPTIONS = subdir-objects
+MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
+
+dist_noinst_DATA = \
+    README.md \
+    $(NULL)
diff --git a/libnetdata/ebpf/README.md b/libnetdata/ebpf/README.md
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/libnetdata/ebpf/README.md
diff --git a/libnetdata/ebpf/ebpf.c b/libnetdata/ebpf/ebpf.c
new file mode 100644
index 0000000000..5cd8b5fcf7
--- /dev/null
+++ b/libnetdata/ebpf/ebpf.c
@@ -0,0 +1,98 @@
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+#include "../libnetdata.h"
+
+static int clean_kprobe_event(FILE *out, char *filename, char *father_pid, netdata_ebpf_events_t *ptr) {
+    int fd =  open(filename, O_WRONLY | O_APPEND, 0);
+    if (fd < 0) {
+        if(out) {
+            fprintf(out, "Cannot open %s : %s\n", filename, strerror(errno));
+        }
+        return 1;
+    }
+
+    char cmd[1024];
+    int length = sprintf(cmd, "-:kprobes/%c_netdata_%s_%s", ptr->type, ptr->name, father_pid);
+    int ret = 0;
+    if (length > 0) {
+        ssize_t written = write(fd, cmd, strlen(cmd));
+        if (written < 0) {
+            if(out) {
+                fprintf(out
+                        , "Cannot remove the event (%d, %d) '%s' from %s : %s\n"
+                        , getppid(), getpid(), cmd, filename, strerror((int)errno));
+            }
+            ret = 1;
+        }
+    }
+
+    close(fd);
+
+    return ret;
+}
+
+int clean_kprobe_events(FILE *out, int pid, netdata_ebpf_events_t *ptr) {
+    debug(D_EXIT, "Cleaning parent process events.");
+    char filename[FILENAME_MAX +1];
+    snprintf(filename, FILENAME_MAX, "%s%s", NETDATA_DEBUGFS, "kprobe_events");
+
+    char removeme[16];
+    snprintf(removeme, 15,"%d", pid);
+
+    int i;
+    for (i = 0 ; ptr[i].name ; i++) {
+        if (clean_kprobe_event(out, filename, removeme, &ptr[i])) {
+            break;
+        }
+    }
+
+    return 0;
+}
+
+//----------------------------------------------------------------------------------------------------------------------
+
+int get_kernel_version() {
+    char major[16], minor[16], patch[16];
+    char ver[256];
+    char *version = ver;
+
+    int fd = open("/proc/sys/kernel/osrelease", O_RDONLY);
+    if (fd < 0)
+        return -1;
+
+    ssize_t len = read(fd, version, sizeof(version));
+    if (len < 0)
+        return -1;
+
+    close(fd);
+
+    char *move = major;
+    while (*version && *version != '.') *move++ = *version++;
+    *move = '\0';
+
+    version++;
+    move = minor;
+    while (*version && *version != '.') *move++ = *version++;
+    *move = '\0';
+
+    if (*version)
+        version++;
+    move = patch;
+    while (*version) *move++ = *version++;
+    *move = '\0';
+
+    return ((int)(str2l(major)*65536) + (int)(str2l(minor)*256) + (int)str2l(patch));
+}
+
+static int has_ebpf_kernel_version(int version) {
+    return (version >= 264960);
+}
+
+int has_condition_to_run(int version) {
+    if(!has_ebpf_kernel_version(version))
+        return 0;
+
+    return 1;
+}
diff --git a/libnetdata/ebpf/ebpf.h b/libnetdata/ebpf/ebpf.h
new file mode 100644
index 0000000000..382f549e7b
--- /dev/null
+++ b/libnetdata/ebpf/ebpf.h
@@ -0,0 +1,16 @@
+#ifndef _NETDATA_EBPF_H_
+# define _NETDATA_EBPF_H_ 1
+
+# define NETDATA_DEBUGFS "/sys/kernel/debug/tracing/"
+
+typedef struct netdata_ebpf_events {
+    char type;
+    char *name;
+
+} netdata_ebpf_events_t;
+
+extern int clean_kprobe_events(FILE *out, int pid, netdata_ebpf_events_t *ptr);
+extern int get_kernel_version();
+extern int has_condition_to_run(int version);
+
+#endif
diff --git a/libnetdata/libnetdata.h b/libnetdata/libnetdata.h
index 7b04ca7cef..a65a37e178 100644
--- a/libnetdata/libnetdata.h
+++ b/libnetdata/libnetdata.h
@@ -312,6 +312,7 @@ extern char *netdata_configured_host_prefix;
 #include "log/log.h"
 #include "procfile/procfile.h"
 #include "dictionary/dictionary.h"
+#include "ebpf/ebpf.h"
 #include "eval/eval.h"
 #include "statistical/statistical.h"
 #include "adaptive_resortable_list/adaptive_resortable_list.h"